API Gateway:Use RAM to manage the permissions on API resources

• A RAM user can manage resources in API Gateway. For example, a RAM user can view, create, or delete API groups, APIs, or plug-ins. However, the RAM user does not own the resources. You can use your Alibaba Cloud account to revoke the permissions on the resources from the RAM user at any time.

• You can use tag-based authorization to isolate resources between your Alibaba Cloud account and RAM users.

• Before you use RAM to manage the permissions on API resources, make sure that you are familiar with RAM and API Gateway. Alibaba Cloud Help Center provides documentation on RAM and API Gateway for you to get familiar with the services.

Section 1: Policy overview

A policy defines the details of permissions and contains the following basic elements: Effect, Resource, Action, and Condition.

1. System policy

API Gateway provides the following built-in system policies: AliyunApiGatewayFullAccess and AliyunApiGatewayReadOnlyAccess. You can log on to the RAM console to view these policies on the Policies page.

• AliyunApiGatewayFullAccess: authorizes a RAM user to manage all API Gateway resources within the relevant Alibaba Cloud account, such as API groups, APIs, throttling policies, and applications.

• AliyunApiGatewayReadOnlyAccess: allows a RAM user to view all API Gateway resources within the relevant Alibaba Cloud account, such as API groups, APIs, throttling policies, and applications. However, the RAM user cannot manage the resources.

2. Custom policy

You can create a custom policy to grant finer-grained permissions, such as the permissions for a specific action or on a specific resource. For example, you can create a custom policy to grant the edit permissions on GetUsers. To view a custom policy that you create, perform the following steps: Log on to the RAM console. In the left-side navigation pane, choose Permissions > Policies. On the page that appears, select Custom Policy from the Policy Type drop-down list and find the policy.

Section 2: Policy syntax

A policy defines a set of permissions based on a specific syntax. You can attach a policy to a user or a group of users to grant them specific permissions on specific resources.

Example:

{
  "Version": "1",
  "Statement": [
    {
  "Action": "apigateway:Describe*",
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}
                

 "Action":"<service-name>:<action-name>"

Section 3: Resource syntax

The Resource element specifies one or more objects that the statement covers. In API Gateway, you can specify an API group, throttling policy, and application in the Resource element. The parameters in the Resource element must be specified in the following format:

acs:<service-name>:<region>:<account-id>:<relative-id>

Parameters:

• acs: indicates that the business scope of the service belongs to Alibaba Cloud public cloud.

• service-name: the name of an Alibaba Cloud service. In this example, apigateway is specified.

• region: the region where the policy applies. You can set this parameter to the wildcard character (*), which indicates that the policy applies in all regions.

• account-id: the ID of the account, such as 123456789012****. You can set this parameter to the wildcard character (*).

• relative-id: the description of the resource on which you want to grant the permissions to a RAM user. You can specify this parameter in the format that is similar to a file path.

An RDPath is in one of the following formats:

acs:apigateway:$regionid:$accountid:apigroup/$groupId

Example:

acs:apigateway:*:*:apigroup/cbd157704e624ab58a204fd3e0b5ad79

The following table describes the API operations that you can specify for the action-name parameter when you create policies to manage the permissions on resources in API Gateway. For more information, see "API Gateway API Reference".

Examples

Authorize a RAM user to query all APIs:

{
          "Version": "1",
          "Statement": [
            {
                      "Action": "apigateway:Describe*",
                      "Resource":"acs:apigateway:$regionid:$accountid:apigroup/*",
                      "Effect": "Allow"
            }
          ]
}                        

Authorize a RAM user to query all API groups to which the `version:v1` tag is attached:

{
	  "Version": "1",
	  "Statement": [
	    {
      		"Action": "apigateway:Describe*",
	      	"Resource":"acs:apigateway:$regionid:$accountid:apigroup/*",
	      	"Effect": "Allow", 
                 "Condition": {
                        "StringEquals": {
                             "apigateway:tag/version": "v1"
                        }
                 }
             }
	  ]
}			

Authorize a RAM user to manage all APIs in an API group:

{
          "Version": "1",
          "Statement": [
            {
                      "Action": "apigateway:*",
                      "Resource": [
                              "acs:apigateway:$regionid:$accountid:apigroup/$groupId",
                              "acs:apigateway:$regionid:$accountid:app/$appId",
                              "acs:apigateway:$regionid:$accountid:vpcaccess/*"
                      ],
                      "Effect": "Allow"
            }
          ]
}

Note: In the preceding examples, you can specify the wildcard character (*) for variables based on your business requirements.